But the outline of PRISM described there seems to confirm (1) and (2), no? They didn't need a subpoena for each user, had access to a search term firehose, and the legal method for (2) was the secret FISA court.

The access isn't as complete as full arbitrary data, but it's also a long way from only responding to known legal warrants and subpoenas.